The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7811 advisory.

    Expat is a C library for parsing XML documents. The mingw-expat packages provide a port of the Expat     library for MinGW.

    The following packages have been upgraded to a later upstream version: mingw-expat (2.4.8). (BZ#2057023,     BZ#2057037, BZ#2057127)

    Security Fix(es):

    * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

    * expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)

    * expat: Integer overflow in storeRawNames() (CVE-2022-25315)

    * expat: Stack exhaustion in doctype parsing (CVE-2022-25313)

    * expat: Integer overflow in copyString() (CVE-2022-25314)

    * expat: Integer overflow in the doProlog function (CVE-2022-23990)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has expat packages installed that are affected by multiple vulnerabilities:

  - In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in     xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
    (CVE-2021-45960)

  - In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for     m_groupSize. (CVE-2021-46143)

  - addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22822)

  - build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22823)

  - defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
    (CVE-2022-22824)

  - lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22825)

  - nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
    (CVE-2022-22826)

  - storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22827)

  - Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with     a nonzero XML_CONTEXT_BYTES. (CVE-2022-23852)

  - xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks     for whether a UTF-8 character is valid in a certain context. (CVE-2022-25235)

  - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs. (CVE-2022-25236)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

  - libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. (CVE-2022-40674)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0021 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-45960:
    In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in     xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).

    CVE-2021-46143:
    In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for     m_groupSize.

    CVE-2022-22822:
    addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-22823:
    build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-22824:
    defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-22825:
    lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-22826:
    nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-22827:
    storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-23852:
    Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with     a nonzero XML_CONTEXT_BYTES.

    CVE-2022-25235:
    xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks     for whether a UTF-8 character is valid in a certain context.

    CVE-2022-25236:
    xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs.

    CVE-2022-25315:
    In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-4252:02 advisory.

    * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)
      * expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)
      * expat: Integer overflow in storeRawNames() (CVE-2022-25315)
      * expat: Stack exhaustion in doctype parsing (CVE-2022-25313)
      * expat: Integer overflow in copyString() (CVE-2022-25314)
      * expat: Integer overflow in the doProlog function (CVE-2022-23990)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0850 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.7.0.

    Security Fix(es):

    * Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)

    * Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)

    * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

    * expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)

    * expat: Integer overflow in storeRawNames() (CVE-2022-25315)

    * Mozilla: Use-after-free in text reflows (CVE-2022-26381)

    * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)

    * Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)

    * Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)

    * thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566)

    * Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 91.7.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1779 advisory.

    A flaw was found in Thunderbird. The vulnerability occurs due to an out-of-bounds write of one byte when     processing the message. This flaw allows an attacker to craft an email message that causes Thunderbird to     perform an out-of-bounds write. (CVE-2022-0566)

    A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences (for example, from start tag     names) to the XML processing application on top of expat can lead to arbitrary code execution. This issue     is dependent on how invalid UTF-8 is handled inside the XML processor. (CVE-2022-25235)

    A flaw was found in expat. Passing one or more namespace separator characters in the xmlns[:prefix]     attribute values made expat send malformed tag names to the XML processor on top of expat. This issue     causes arbitrary code execution depending on how unexpected cases are handled inside the XML processor.
    (CVE-2022-25236)

    An integer overflow was found in expat. The issue occurs in storeRawNames() by abusing the m_buffer     expansion logic to allow allocations very close to INT_MAX and out-of-bounds heap writes. This flaw can     cause a denial of service or potentially arbitrary code execution. (CVE-2022-25315)

    The Mozilla Foundation Security Advisory describes this flaw as:

    An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a     potentially exploitable crash. (CVE-2022-26381)

    The Mozilla Foundation Security Advisory describes this flaw as:

    When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen     notification. (CVE-2022-26383)

    The Mozilla Foundation Security Advisory describes this flaw as:

    If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts,     they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the     sandbox. (CVE-2022-26384)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Previously Thunderbird for macOS and Linux would download temporary files to a user-specific directory in     /tmp, but this behavior was changed to download them to /tmp where they could be affected by other local     users. This behavior was reverted to the original, user-specific directory. (CVE-2022-26386)

    The Mozilla Foundation Security Advisory describes this flaw as:

    When installing an add-on, Thunderbird verified the signature before prompting the user; but while the     user was confirming the prompt, the underlying add-on file could have been modified and Thunderbird would     not have noticed. (CVE-2022-26387)

    The Mozilla Foundation Security Advisory describes this flaw as:

    Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had     reports of attacks in the wild abusing this flaw. (CVE-2022-26485)

    The Mozilla Foundation Security Advisory describes this flaw as:

    An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox     escape. We have had reports of attacks in the wild abusing this flaw. (CVE-2022-26486)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in     xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
    (CVE-2021-45960)

  - In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for     m_groupSize. (CVE-2021-46143)

  - addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22822)

  - build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22823)

  - defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
    (CVE-2022-22824)

  - lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22825)

  - nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
    (CVE-2022-22826)

  - storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22827)

  - Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with     a nonzero XML_CONTEXT_BYTES. (CVE-2022-23852)

  - Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. (CVE-2022-23990)

  - xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks     for whether a UTF-8 character is valid in a certain context. (CVE-2022-25235)

  - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs. (CVE-2022-25236)

  - In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large     nesting depth in the DTD element. (CVE-2022-25313)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. (CVE-2022-25314)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks     for whether a UTF-8 character is valid in a certain context. (CVE-2022-25235)

  - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs. (CVE-2022-25236)

  - In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large     nesting depth in the DTD element. (CVE-2022-25313)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. (CVE-2022-25314)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0021 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2021-45960:
    In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in     xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).

    CVE-2021-46143:
    In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for     m_groupSize.

    CVE-2022-22822:
    addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-22823:
    build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-22824:
    defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-22825:
    lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-22826:
    nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-22827:
    storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-23852:
    Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with     a nonzero XML_CONTEXT_BYTES.

    CVE-2022-25235:
    xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks     for whether a UTF-8 character is valid in a certain context.

    CVE-2022-25236:
    xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs.

    CVE-2022-25315:
    In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0142 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2022-40674:
      A vulnerability was found in expat. With this flaw, it is possible to create a situation in which     parsing is suspended while substituting in an internal entity so that XML_ResumeParser directly uses the     internalEntityProcessor as its processor. If the subsequent parse includes some unclosed tags, this will     return without calling storeRawNames to ensure that the raw versions of the tag names are stored in memory     other than the parse buffer itself. Issues occur if the parse buffer is changed or reallocated (for     example, if processing a file line by line), problems occur. Using this vulnerability in the doContent     function allows an attacker to triage a denial of service or potentially arbitrary code execution.

      CVE-2022-25236:
      A flaw was found in expat. Passing one or more namespace separator characters in the xmlns[:prefix]     attribute values made expat send malformed tag names to the XML processor on top of expat. This issue     causes arbitrary code execution depending on how unexpected cases are handled inside the XML processor.

      CVE-2022-25235:
      A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences (for example, from start tag     names) to the XML processing application on top of expat can lead to arbitrary code execution. This issue     is dependent on how invalid UTF-8 is handled inside the XML processor.

      CVE-2022-25313:
      A flaw was found in expat. A stack exhaustion in doctype parsing could be triggered by a file with a     large number of opening braces, resulting in a denial of service.

      CVE-2022-25314:
      An integer overflow flaw was found in expat. This issue affects the encoding name parameter at the     parser creation time, which is often hard-coded (rather than user input), takes a value in the gigabytes     to trigger, and on a 64-bit machine. This flaw can cause a denial of service.

      CVE-2022-25315:
      An integer overflow was found in expat. The issue occurs in storeRawNames() by abusing the m_buffer     expansion logic to allow allocations very close to INT_MAX and out-of-bounds heap writes. This flaw can     cause a denial of service or potentially arbitrary code execution.

      CVE-2018-20843:
      It was discovered that the setElementTypePrefix() function incorrectly extracted XML namespace     prefixes. By tricking an application into processing a specially crafted XML file, an attacker could cause     unusually high consumption of memory resources and possibly lead to a denial of service.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-3104:04 advisory.

    * Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)
      * Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)
      * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)
      * expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)
      * expat: Integer overflow in storeRawNames() (CVE-2022-25315)
      * Mozilla: Use-after-free in text reflows (CVE-2022-26381)
      * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)
      * Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)
      * Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)
      * thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566)
      * Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-3095:06 advisory.

    * Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)
      * Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)
      * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)
      * expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)
      * expat: Integer overflow in storeRawNames() (CVE-2022-25315)
      * Mozilla: Use-after-free in text reflows (CVE-2022-26381)
      * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)
      * Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)
      * Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)
      * Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.207 advisory.

  - In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in     xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
    (CVE-2021-45960)

  - The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path,     leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in     /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an     incomplete fix for CVE-2016-10009. (CVE-2023-38408)

  - An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the     attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content     to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing     filenames with two or more newlines where selected content and the target file names are embedded in     crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write     arbitrary files on the system. (CVE-2022-1271)

  - http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5     allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR     and LF control characters in the first argument of HTTPConnection.request. (CVE-2020-26116)

  - urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as     demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this     is similar to CVE-2020-26116. (CVE-2020-26137)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20201105.30398. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20201105.30398 advisory.

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

  - In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in     xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
    (CVE-2021-45960)

  - The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop     forever for non-prime moduli. Internally this function is used when parsing certificates that contain     elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point     encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has     invalid explicit curve parameters. Since certificate parsing happens prior to verification of the     certificate signature, any process that parses an externally supplied certificate may thus be subject to a     denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they     can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients     consuming server certificates - TLS servers consuming client certificates - Hosting providers taking     certificates or private keys from customers - Certificate authorities parsing certification requests from     subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that     use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS     issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate     which makes it slightly harder to trigger the infinite loop. However any operation which requires the     public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-     signed certificate to trigger the loop during verification of the certificate signature. This issue     affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the     15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected     1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc). (CVE-2022-0778)

  - In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for     m_groupSize. (CVE-2021-46143)

  - addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22822)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
167142	RHEL 8 : mingw-expat (RHSA-2022:7811)	Nessus	Red Hat Local Security Checks	2022/11/9	2025/3/15	critical
187329	NewStart CGSL MAIN 6.06 : expat Multiple Vulnerabilities (NS-SA-2023-0082)	Nessus	NewStart CGSL Local Security Checks	2023/12/27	2023/12/27	critical
236603	Alibaba Cloud Linux 3 : 0021: expat (ALINUX3-SA-2022:0021)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
293270	MiracleLinux 8 : mingw-expat-2.4.8-1.el8 (AXSA:2022-4252:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
158907	RHEL 7 : thunderbird (RHSA-2022:0850)	Nessus	Red Hat Local Security Checks	2022/3/14	2025/8/15	critical
160270	Amazon Linux 2 : thunderbird (ALAS-2022-1779)	Nessus	Amazon Linux Local Security Checks	2022/4/27	2024/12/11	critical
163220	EulerOS Virtualization 2.10.0 : expat (EulerOS-SA-2022-2022)	Nessus	Huawei Local Security Checks	2022/7/15	2023/10/17	critical
163627	EulerOS Virtualization 2.9.1 : expat (EulerOS-SA-2022-2178)	Nessus	Huawei Local Security Checks	2022/7/29	2023/10/17	critical
239166	TencentOS Server 3: expat (TSSA-2022:0021)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	critical
239666	TencentOS Server 3: mingw-expat (TSSA-2023:0142)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/22	critical
291667	MiracleLinux 8 : thunderbird-91.7.0-2.el8.ML.1 (AXSA:2022-3104:04)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	critical
294697	MiracleLinux 8 : firefox-91.7.0-3.el8.ML.1 (AXSA:2022-3095:06)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
180469	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.207)	Nessus	Misc.	2023/9/4	2026/1/21	low
165508	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20201105.30398)	Nessus	Misc.	2022/9/27	2026/1/21	critical
224526	Linux Distros Unpatched Vulnerability : CVE-2022-25315	Nessus	Misc.	2025/3/5	2026/7/30	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

low

critical

critical